Overview

overview

10

Static

static

a0d2eb068a...69.exe

windows7-x64

10

a0d2eb068a...69.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0d2eb068a2634f9f7f595106f1691fafe3a73771acc78f2e552be84abc7ef69

  • Size

    5.5MB

  • Sample

    221125-gdtxeshg6t

  • MD5

    3389b0ae28574ebdb3ee468054ab8bdd

  • SHA1

    38f4733c794762ab13d0f1f1d55314ce95db27c6

  • SHA256

    a0d2eb068a2634f9f7f595106f1691fafe3a73771acc78f2e552be84abc7ef69

  • SHA512

    e317e8a81ac5a0cba42787c542d24daeef485970ff1389b4f2c8e70dd3d13aa1fd4957ecfe7916f084807f753c24bb1d7aef3cce600d9d96fb645dcc54be161e

  • SSDEEP

    98304:wJTPo1qdbRaMAPp2+32ooNgji1mpAHzpqGejFWvxjKte2CUn:mw/kS2ooVmg+

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      a0d2eb068a2634f9f7f595106f1691fafe3a73771acc78f2e552be84abc7ef69

    • Size

      5.5MB

    • MD5

      3389b0ae28574ebdb3ee468054ab8bdd

    • SHA1

      38f4733c794762ab13d0f1f1d55314ce95db27c6

    • SHA256

      a0d2eb068a2634f9f7f595106f1691fafe3a73771acc78f2e552be84abc7ef69

    • SHA512

      e317e8a81ac5a0cba42787c542d24daeef485970ff1389b4f2c8e70dd3d13aa1fd4957ecfe7916f084807f753c24bb1d7aef3cce600d9d96fb645dcc54be161e

    • SSDEEP

      98304:wJTPo1qdbRaMAPp2+32ooNgji1mpAHzpqGejFWvxjKte2CUn:mw/kS2ooVmg+

    Score
    10/10
    evasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks